3 ms·

I've always wondered why there is even a distinction between Log in and Sign up at all. Surely if the user is logging in with their email address, the app can d

• ec109685 5y ago
  Existing users could end up accidentally creating a new account? That said, fast.co does this to streamline their flows.
• mhitza 5y ago
  Depends how you handle existing users. If on such a form you output something like, "a user with this email address already exists", bots with targeted email could scan for site accounts. On the other hand on a separate login form, you can always output "invalid credentials" on non matching email or password.
  • cratermoon 5y ago
    > bots with targeted email could scan for site accounts Indeed. A good login form will give away nothing about whether or not the attempt failed because the username doesn't exist or because the password was wrong, or anything that leaks to a malicious party information. There's always a balance between security and convenience, and where that balance lies is determined by your threat model. It's almost universally an anti-pattern to respond in a way that lets a potential attacker that they've found a valid username for your site.